Docker Networking

Docker networking is the mechanism that allows containers to communicate with each other, with the host, and with external networks.

Containers are isolated processes, and without networking they cannot communicate or expose services.

A container network is a virtual network that connects containers and controls how traffic flows between them.

Docker creates a default bridge network for new containers unless another network is specified.

A bridge network is an internal virtual network that allows connected containers to communicate with each other.

Docker bridge is the default Linux bridge device used by Docker to connect containers on the same host.

A Docker network driver defines how container networking is implemented, such as bridge, host, overlay, macvlan, ipvlan, and none.

Host network mode makes a container share the host network namespace directly.

None mode disables networking inside the container entirely.

It is communication between two or more containers over a Docker-managed network.

Port publishing maps a container port to a host port so external clients can reach the container.

Port mapping is another term for port publishing, often written as host:container.

The main Docker networking commands include:

• docker network ls
• docker network inspect
• docker network create
• docker network rm

Each container on a Docker network can have an IP address assigned to its interface.

A network namespace provides an isolated networking stack for a container, separate from the host.

A veth pair connects a container network interface to the Docker bridge or another network device.

It is the bridge device that acts as a virtual switch for containers on the same host.

Docker automatically assigns a name to a container, which can be used for communication in custom networks.

Docker provides internal DNS resolution so containers can resolve service names on user-defined networks.

Service discovery is the ability to resolve container names and service names to IP addresses.

Docker Compose creates a default network for the services in a compose project and connects them automatically.

Because they are attached to the same virtual bridge and share the same layer-2 segment.

A user-defined network is a custom Docker bridge network created by the user for better isolation and DNS.

User-defined bridge networks provide better DNS, automatic service discovery, and better isolation than the default bridge.

Docker can put a container directly on the host network namespace using –network host.

It isolates a container completely from all networking.

A container port is an application port exposed inside the container, such as 8080 or 5432.

A host port is a port on the physical or VM host that forwards traffic to a container.

This Docker command publishes port 80 inside the container to port 8080 on the host.

Exposing declares a port in the image metadata, while publishing publishes it to the host.

Containers are isolated; a port is only reachable externally if explicitly published or attached to an accessible network.

IPAM (IP Address Management) assigns IP addresses within Docker networks.

It creates a new Docker network with a chosen driver and options.

It shows details about a network, such as subnets, gateways, and attached containers.

A subnet is a range of IP addresses assigned to a Docker network.

A gateway is the device or IP used as the default route for traffic leaving a network.

A MAC address identifies a container network interface on the local network segment.

It is the address range used by a Docker bridge network, such as 172.17.0.0/16.

It is the gateway IP assigned to the bridge for traffic leaving the network.

Network isolation restricts traffic between container groups or networks.

An internal Docker network prevents external access to the containers on that network.

A Docker network alias is an alternate name used for a container on a user-defined network.

The container name is used by Docker; the hostname is the system hostname inside the container.

Docker automatically resolves a container name to its IP on a user-defined network.

They improve discovery, isolation, and easier service interaction than relying on random default bridge networking.

It is traffic from a container to the host machine through the bridge or host network.

It is traffic from the host to a published port of a container.

It is communication between a container and systems outside the Docker host.

A plugin extends Docker networking with custom implementations beyond built-in drivers.

Example: docker network create mynet

A worker node runs workloads and participates in the Swarm overlay network.

A manager node coordinates the services and cluster state in Swarm.

Because services run on different Docker hosts and need inter-host connectivity.

Overlay networking creates a virtual network across multiple hosts, often used in Swarm or Kubernetes.

A swarm service is a container task managed by Docker Swarm and connected via an overlay network.

Swarm provides service name resolution to load balance traffic across tasks.

Ingress in Swarm is an overlay network used to publish ports and route incoming traffic to service tasks.

A published port exposes a service externally across the cluster.

A task is one instance of a service running on a node.

Docker assigns IPs from the overlay network and manages reachability across nodes.

Common built-in drivers include bridge, host, overlay, macvlan, ipvlan, and none.

The bridge driver creates an isolated internal network for containers on a single host.

The overlay driver creates a network spanning multiple hosts for swarm or other overlay-based deployments.

The host driver makes the container share the host network directly.

The none driver completely disables networking.

macvlan attaches a container directly to a physical network interface using its own MAC address.

ipvlan attaches containers to a parent interface while preserving the L2 or L3 semantics of the host network.

macvlan exposes a distinct MAC per container; ipvlan usually shares the parent MAC while separating L3 identities.

It creates an isolated networking stack so container interfaces and routing are not visible to other containers or the host.

Linux bridge is a software switch used by Docker bridge networks to virtualize layer-2 communication.

Docker creates a veth peer for each container, connecting the container namespace to a bridge or network device.

They keep container networking separate from the host and other containers.

DNAT (Destination Network Address Translation) is the mechanism that changes the destination of packets as they pass through Docker port publishing.

SNAT (Source Network Address Translation) changes the source address of packets leaving a network segment, commonly used for outbound connections.

Docker uses iptables rules to implement port publishing, NAT, filtering, and communication policies.

nftables is a modern replacement for iptables and may be used by newer Docker and Linux networking stacks.

To enforce NAT, port publishing, and traffic filtering between containers and the host.

Traffic filtering controls which network connections are allowed between containers or between a container and the outside world.

A network policy restricts which containers can communicate with each other, commonly used in orchestrators like Kubernetes.

A label is metadata associated with a network used to identify or configure it.

Driver options are extra parameters used when creating a network, such as subnet, gateway, or internal.

A subnet option defines the address range assigned to a network.

A gateway option sets the default gateway for a Docker network.

An internal network prevents the network from being routed to the outside world.

Docker’s embedded DNS resolves service names inside user-defined networks.

The hostname of a container is usually the container name; resolvers can resolve it inside a Docker network.

DNS aliasing means the same service can be reached via multiple names.

Because default bridge lacks modern service-discovery and isolation features.

It is usually bridge.

docker0 is the Linux bridge created by Docker for the default bridge network.

MTU is the maximum transmission unit; Docker networks may use host-default MTU values.

Incorrect MTU values can cause fragmentation or connectivity issues, especially with VPNs or overlays.

Docker can inject DNS servers, search domains, and options into containers via the network config.

A network attach is the act of connecting a container to a specific Docker network.

A container attached to more than one Docker network can communicate with all attached networks.

A container interface is the virtual network device attached inside the container’s network namespace.

Two containers can share a network namespace if they use host mode or a custom setup.

Docker networks allow containers to resolve each other by hostname or name.

Two services may rely on network connectivity to communicate between containers or services.

A service mesh is an application-level control plane on top of network connectivity; Docker networking is the lower-level connectivity layer.

Docker relies heavily on Linux networking primitives: bridge devices, veth pairs, iptables, namespaces, and routes.

A routed network sends traffic as L3 traffic between hosts or networks rather than L2 broadcast domains.

L2 is link-layer switching; L3 is IP routing between networks.

It creates a virtual network spanning multiple Docker hosts and uses VXLAN or similar encapsulation.

VXLAN is a tunneling protocol often used by Docker overlay and SDN solutions to carry layer-2 traffic over layer-3 networks.

Encapsulation wraps the original packet in another packet for transport across hosts or networks.

Because containers on different hosts cannot talk directly without network-level virtualization.

A network controller manages and configures the virtual network in a distributed environment.

A virtual switch is a software bridge or switching component that forwards layer-2 traffic in a network.

A virtual network is an abstract network layer created in software to isolate or connect workloads.

A bridge network is local to a host. An overlay network spans across multiple hosts.

Some drivers require extra packages or agent processes to work across hosts.

A cluster network connects workloads across multiple nodes in an orchestrated environment.

A Swarm overlay network connects containers from different nodes in the same cluster.

Publish mode defines how a service port is exposed, such as ingress or host mode.

Ingress mode routes traffic through the Swarm ingress network to reach the correct service task.

Host mode lets a service bind directly to the host network rather than through ingress.

A local network is a Docker network that does not extend across cluster nodes.

Multiple services on the same host cannot bind the same host port unless using special network configurations.

It happens when two containers attempt to use the same exposed internal port without a conflicting mapping.

Use docker ps, docker inspect, docker logs, ip addr, ip route, ping, and tcpdump.

docker exec allows executing commands inside a running container for network debugging.

docker logs shows application and networking-related logs from a container.

It shows details like IP addresses, gateway, network options, and connected containers.

IP forwarding allows packets to move between interfaces and networks, usually enabled in Linux for routing.

Without it, containers may not reach external networks or other network segments.

A NAT rule rewrites source or destination addresses or ports for routing and address conservation.

Docker uses DNAT to map host ports to container ports.

Port allocation is how Docker chooses host ports when a container publishes a port automatically.

If no host port is specified, Docker may pick an available random port for publishing.

It is the mapping of host:container, such as 0.0.0.0:8080->80/tcp.

Binding to 0.0.0.0 means listening on all interfaces on the host, not just localhost.

Binding to localhost means the service is only reachable from the local machine, not remote hosts.

It happens when a container or service tries to connect to a network with a driver that does not support the required topology.

Docker removes the container network namespace when the container is deleted.

It is the process of removing interfaces, routes, IPAM state, and firewall rules after a container stops.

Restarting Docker can temporarily disrupt container traffic while networks and daemons reinitialize.

It includes IP assignment, veth links, iptables rules, routes, and DNS metadata.

It includes driver startup, network creation, attach/detach, and cleanup.

Compose automatically creates a network and aliases service names so containers can discover each other by service name.

Inter-container DNS is name resolution between containers on the same Docker network.

The DNS search domain adds suffixes to short names so they can be resolved as FQDNs.

User-defined bridge networks provide container name resolution, unlike legacy bridge networks.

They provide stable names for application clients rather than ephemeral IP addresses.

Compose service names are automatically resolvable on the project network.

A Compose project network is a Docker network created for a project’s services.

Because packets need to know where to go to reach other containers, services, or external networks.

It is the routing table inside the container namespace showing destinations and gateways.

It is the host OS routing table used to route packets between Docker bridges and other networks.

A local route is a route to a directly connected network or interface.

A default route sends traffic not matching a specific route to a gateway or network border.

Network segmentation divides container traffic into separate network boundaries for isolation and security.

It occurs if two networks use overlapping IP ranges, causing routing or connectivity problems.

Network overlap refers to two networks assigning the same or conflicting IP ranges.

docker network prune removes unused or dangling Docker networks.

A dangling network is a Docker network not currently attached to any container.

It happens when a chosen driver depends on Linux features or host configuration that is not available.

It is a user-defined IP range for a Docker bridge network, configured when the network is created.

Bridge isolation restricts traffic between containers attached to the same bridge or between specific networks.

It uses IPv4 addressing only.

It uses IPv6 addressing, often requiring additional host configuration and kernel support.

Because many deployments still use IPv4 and dual-stack support is more complex.

Docker resolves internal names while iptables handles external translation and forwarding.

It is packet capture inside a container or on the host to analyze network behavior.

tcpdump can be run inside or outside a container to inspect packets and diagnose networking issues.

Health checks can verify a service is listening on a port before traffic is routed to it.

They help ensure backends are actually reachable before routing traffic.

It may be handled by a reverse proxy, Swarm ingress, or a cloud load balancer.

A sidecar proxy runs alongside a container and can handle networking, service mesh, or policy enforcement.

A service may depend on a specific network being created or connected before it starts.

Containers may need the network to be up before they start or before dependencies are reachable.

A startup race occurs when services try to connect before a dependent container or network is ready.

A service is ready when it can accept traffic and respond successfully to health checks.

Docker restart policies control whether containers restart after network-related failures.

A timeout is the duration before a connection or request fails due to no response.

Stable names allow the app, proxy, and service discovery layer to find backends without hardcoded IPs.

A service registry maintains service addresses and metadata for dynamic discovery.

It is the mechanism for locating other services or tasks by name, often via DNS.

Ephemeral IP churn is when container IPs change due to recreation, which is why names are better than raw IPs.

Because container IPs can change when containers restart or move.

Overlay networking often uses VXLAN encapsulation and a distributed control plane to connect hosts.

The underlay is the physical or routed infrastructure carrying the overlay tunnel traffic.

It is the real network fabric that carries container traffic across hosts or cloud environments.

Overlay encryption secures traffic between hosts in an overlay network.

It controls allowed traffic patterns between pods or services and is often enforced by CNI plugins.

CNI (Container Network Interface) is a specification for configuring container networking in orchestrators like Kubernetes.

Docker uses its own networking model, but similar concepts appear in CNI-based runtimes like Kubernetes.

eBPF enables programmable packet processing in the Linux kernel for filtering, observability, and custom routing.

It includes metrics, packet capture, logs, DNS resolution traces, and topology inspection.

It is the act of seeing the raw packets flowing through a network namespace for troubleshooting.

A networking loop occurs when packets are continuously forwarded in a cycle, often due to misconfiguration.

A routing leak occurs when traffic is advertised or forwarded beyond the intended network boundary.

ARP resolves layer-2 neighbors for containers on the same network segment.

Because containers on the same Linux bridge need to resolve each other’s MAC addresses.

A multicast network sends data to a defined group of listeners rather than to every host.

Traffic mirroring duplicates packets to a monitoring or security system for analysis.

It is a business or security policy that separates traffic by trust level or application boundary.

It may be implemented via iptables and restrict traffic entering or leaving containers and host ports.

It is the set of networking interfaces, ports, and exposure points available to a container.

Docker networking is not just about connectivity; it is about isolation, traffic control, name resolution, topology, and secure communication between containers and hosts.